How ERC-20 Tokens Work: The Mechanics Explained

ERC-20 tokens feel like digital cash you hold in a wallet, but under the hood they work very differently from that mental picture. There are no coins moving around and nothing is stored in your wallet app. This guide opens up the machine and explains, in plain language, exactly how an ERC-20 token works — the ledger, transfers, approvals, events, decimals and gas — so you understand what's really happening every time you send or swap a token.

A token is a smart contract, not a coin

The single most important idea is this: an ERC-20 token is a smart contract. It is a program deployed to a permanent address on Ethereum. That program does one core job — it maintains a ledger that records how many tokens each address holds. When people say they "own" a token, what they really mean is that the token's contract has an entry saying their address has a certain balance. There is no physical coin and nothing sitting inside your MetaMask. Your wallet is simply a key that can authorise changes to that ledger.

This is why every ERC-20 token has a contract address, and why you add a token to your wallet by pasting that address. You're telling your wallet, "go read my balance from this particular ledger."

The ledger: a balance mapping

Inside the contract is a data structure — conceptually a table — that maps each address to a number. In Solidity it looks like mapping(address => uint256) balanceOf. If your address has 1,000 tokens, the contract stores the number 1,000 (technically scaled by decimals, more on that below) next to your address. The totalSupply value records the grand total of every balance combined. That's the entire heart of a token: a list of who holds how much.

What happens during a transfer

When you send tokens, you call the contract's transfer(recipient, amount) function. The contract checks that your balance is at least the amount, then it subtracts the amount from your entry and adds it to the recipient's entry. That's it. Nothing travels across the network; two numbers in a table change. Finally, the contract emits a Transfer event — a log that says "X sent Y tokens to Z." Wallets, explorers and analytics tools watch for these events to keep their displays up to date.

The approve and transferFrom model

Direct transfers cover sending tokens to a friend, but decentralized apps need a different mechanism. A smart contract — like a Uniswap pool — can't reach into your balance and take tokens; that would be unsafe. Instead, ERC-20 uses a two-step allowance model:

• approve(spender, amount) — you authorise another address (the spender) to move up to a certain amount of your tokens. This records an allowance in the contract.
• transferFrom(owner, recipient, amount) — the approved spender calls this to actually pull the tokens, as long as it stays within the allowance.

This is exactly why, the first time you trade a new token on a DEX, your wallet asks you to "approve" it before you can swap. You're granting the router permission to pull that token from your balance during the swap. The allowance(owner, spender) function reports how much permission remains.

Why approvals matter for security

The allowance model is powerful but it's also where a lot of risk lives. Many apps request an unlimited approval for convenience, meaning the spender can move all of that token, now and forever, until you revoke it. If that spender contract is malicious or gets exploited, your approved tokens can be drained. The defensive habits are simple: only approve contracts you trust, prefer exact-amount approvals when offered, and periodically revoke approvals you no longer use with a tool like Etherscan's token approvals checker. Our ERC-20 token security guide covers this in depth.

Events: how the outside world tracks tokens

The contract itself doesn't notify anyone of changes — instead it emits events, which are cheap, searchable logs stored on-chain. The two standard ones are Transfer and Approval. Block explorers, wallets and indexers like The Graph scan these events to reconstruct balances, show transaction histories, and power dashboards. This is also how a token feed (like our recently created tokens page) works: it reads TokenCreated and Transfer logs directly from the chain rather than any database.

Decimals: why balances are giant integers

Computers on Ethereum don't use fractions, so ERC-20 tokens store balances as whole numbers and use a decimals value to tell wallets where to place the decimal point. With the standard 18 decimals, "1 token" is stored internally as 1 followed by eighteen zeros. When your wallet shows you 1.5 tokens, it's really reading 1,500,000,000,000,000,000 and dividing by 10^18 for display. This lets tokens be divided into tiny fractions smoothly. If you're choosing a value for your own token, our guide on choosing supply and decimals explains why 18 is almost always the right pick.

totalSupply, minting and burning

The totalSupply is simply the sum of all balances. Two operations change it:

• Minting creates new tokens, increasing someone's balance and the total supply. Only possible if the contract has a mint function and the caller is authorised.
• Burning destroys tokens, decreasing a balance and the total supply permanently.

A fixed-supply token simply mints the entire amount once, at deployment, to the creator's address — and never mints again. That's the most predictable model and the reason many communities prefer it. See why immutable tokens are safer.

Who pays, and in what

Every state change — transfer, approve, mint, burn — costs gas, paid in ETH by whoever sends the transaction. The token itself is not the gas; you always need a little ETH in your wallet to move ERC-20 tokens. This trips up beginners who buy a token, then can't send it because they have zero ETH for gas. Our Ethereum gas fees explained guide breaks down exactly how those costs are calculated.

How wallets display a token

When you add a token to MetaMask, your wallet calls three read-only functions on the contract: name(), symbol() and decimals() for the label and formatting, and balanceOf(yourAddress) for your balance. Reading is free — it doesn't cost gas — because it doesn't change anything. The wallet just queries the contract and formats the result. See add your token to MetaMask for the steps.

How DEXs and DeFi use the standard

Because every ERC-20 exposes the same functions, a decentralized exchange doesn't need custom code for each token. It calls approve and transferFrom in a standard way, so the moment your token is deployed it can be added to a liquidity pool and traded. This universal compatibility — the same interface everywhere — is the entire reason ERC-20 became the backbone of DeFi. A token built today instantly works with Uniswap, aggregators, lending markets and portfolio trackers.

What the standard requires vs. what's optional

The ERC-20 standard mandates a specific set of functions and events so that wallets and apps can rely on them. It does not dictate the internal behaviour. That's why two tokens can both be valid ERC-20s yet behave very differently: one immutable and ownerless, another mintable, pausable or taxed. The interface is the contract with the outside world; the logic inside is up to the creator. Our features guide walks through the common optional behaviours.

Reading a token contract on Etherscan

You can inspect any token yourself. On Etherscan, open the contract address and use the "Read Contract" tab to call totalSupply, balanceOf, owner and more without spending gas. If the source is verified, the "Contract" tab shows the actual code — letting you confirm whether a mint function exists, whether there's an owner, and what powers that owner has. Learning to read this is the single best skill for avoiding bad tokens; see verify a contract on Etherscan.

Putting it together

So the full picture of a token transfer is: you sign a transaction with your private key, broadcast it to the network, miners/validators execute the contract's transfer function, the contract edits two balance entries, it emits a Transfer event, you pay gas in ETH, and explorers update from the event. No coins moved — a shared ledger was edited, securely and verifiably, by code that anyone can audit.

Create your own ERC-20

Understanding the mechanics makes creating a token far less mysterious. With a no-code tool like Create ERC-20 Token, you set the name, symbol, supply and decimals, and a verified contract implementing exactly the behaviour above is deployed for you in one transaction. Follow our step-by-step creation guide to launch yours.

Conclusion

An ERC-20 token is a smart contract that keeps a ledger of balances and exposes a standard set of functions so the whole ecosystem can interact with it. Transfers edit entries and emit events; approvals let contracts pull tokens safely; decimals format the integers; and gas in ETH powers every change. Once you see tokens as shared, auditable ledgers rather than coins in a wallet, everything about how they move — and how to keep them safe — makes sense.

Frequently Asked Questions